Improper Access Control Vulnerability in Mintplex-Labs Anything-LLM Application

CVE-2024-3279

What is CVE-2024-3279?

An improper access control vulnerability has been identified in the Anything-LLM application developed by Mintplex Labs. This vulnerability is found specifically in the import endpoint, where an unauthorized user can exploit the system. By bypassing authentication, an attacker can import a malicious database file that can delete or corrupt the existing 'anythingllm.db' file. This manipulation not only jeopardizes the integrity of the affected database but also allows attackers to serve harmful data or gather sensitive user information. The root cause of this vulnerability lies in the application's inadequate restrictions on import functionality, highlighting a critical security oversight.

References